The installation program does not configure the agent so that it can automatically import into the Access Manager Administration Console. For the WebLogic Agent, installation is a two part process.
Run the installation program to copy the files to the server. See Section 1.4.1, Linux Installation or Section 1.4.2, Windows Installation.
Configure the agent so that it auto-imports into the Administration Console. See Section 1.4.3, Configuring for Auto Import.
Verify that the machine meets the minimum requirements. See Section 1.1.3, WebLogic Agent Requirements.
Download the agent from Novell.
Untar the file.
Change to the Access Manager directory.
At the command prompt of the Access Manager directory, enter the following:
./install.sh
Review and accept the License Agreement.
Enter the IP address of the Administration Console machine.
Enter the name of the administrator for the Administration Console.
Enter and confirm the password for this administrator.
This starts the installation of some components.
When prompted, enter the base directory of the application server.
This is the directory where you installed the WebLogic server.
A few more modules are installed and then configured.
Configure the agent so that it imports into the Administration Console. See Section 1.4.3, Configuring for Auto Import.
Verify that the machine meets the minimum requirements. See Section 1.1.3, WebLogic Agent Requirements.
Download the agent from Novell.
Execute the file.
Read the welcome information, then click .
Note where additional Access Manager information can be found, then click .
Review the License Agreement, accept it, then click .
Specify where you want the WebLogic Agent installed.
The default directory is c:\Novell. WebLogic does not deal well with spaces in directory names, so if possible do not use a space in the directory name (such as Program Files).
Select to install the WebLogic Agent.
If the installation program cannot detect that you have installed a WebLogic server on the machine where you are installing the agent, you are notified of this condition. You can install the WebLogic server after you have installed the agent.
Enter the information required for server communication between the agent and the Administration Console. Fill in the following fields and carefully review your information:
Administration Console Admin Username: Specify the username of the admin user of the Administration Console.
Administration Console Admin Password: Specify the password for the admin user of the Administration Console. Confirm the password by re-entering it.
Administration Console IP Address: Specify the IP address of your Administration Console.
IP Address of the Application Server: Review the entered address. If your server is configured for more than one IP address, make sure the one you want to use is specified in this box.
Click , then review the installation summary.
To install the agent, click .
When the installation has finished, review the logs to see if you need to remove any sensitive data.
Click , then .
A browser appears with the J2EE installation documentation displayed.
Configure the agent so that it imports into the Administration Console. See Section 1.4.3, Configuring for Auto Import.
The WebLogic installation program installs the files, but it does not configure either the nesp.ear application or the JAAS module so that the WebLogic J2EE Agent can automatically import into the Administration Console. To enable the import, complete the following:
Determine the following paths on your machine:
WL_HOME: The WebLogic home path, which defaults to /root/bea/weblogic92 in Linux and C:\bea\weblogic92 in Windows.
WL_DOMAIN: The domain home path, which defaults to /root/bea/user_projects/domains/base_domain in Linux and C:\bea\user_projects\domains\base_domain in Windows.
AGENT_HOME: The Agent install location, which defaults to /opt/novell/nids_agents/lib in Linux and C:\Novell in Windows.
Copy the NidsWebLogicAgentMBeans.jar from the AGENT_HOME/lib directory to the WL_HOME/server/lib/mbeantypes directory.
This jar contains the Novell Access Manager Authentication Provider for WebLogic as well as the JACC provider.
Edit the common environment variable file:
Linux: For the Linux platform, edit the WL_HOME/common/bin/commEnv.sh file and add the lines below to the end of the script:
#Novell J2EE Agent Settings
AGENT_LIB="/opt/novell/nids_agents/lib"
WEBLOGIC_CLASSPATH="${AGENT_LIB}/xml-apis.jar/${PATHSEP}${AGENT_LIB}/xercesImpl.jar${PATHSEP}${AGENT_LIB}/xalan.jar${PATHSEP}${AGENT_LIB}/serializer.jar${PATHSEP}${WEBLOGIC_CLASSPATH}${PATHSEP}${AGENT_LIB}/NidsCommonAgent.jar${PATHSEP}${AGENT_LIB}/NidsWebLogicAgent.jar${PATHSEP}${AGENT_LIB}/LogEvent.jar${PATHSEP}${AGENT_LIB}/jcc.jar${PATHSEP}${AGENT_LIB}/nxpe.jar${PATHSEP}${AGENT_LIB}/nxpe-toolkit.jar${PATHSEP}${AGENT_LIB}/commons-jxpath-1.2.jar"
export WEBLOGIC_CLASSPATH
#Set library path to /usr/lib so the Agent can Audit Events.
export LD_LIBRARY_PATH=${LD_LIBRARY_PATH}:/usr/lib
The WEBLOGIC_CLASSPATH value needs to be added to the file without adding line breaks or spaces.
Windows: For the Windows platform, edit the WL_HOME\common\bin\commEnv.cmd file and add the following lines to the bottom. Modify AGENT_LIB to point AGENT_HOME/lib:
@rem Novell J2EE Agent Settings set AGENT_LIB=C:\novell\lib set WEBLOGIC_CLASSPATH=%AGENT_LIB%\xml-apis.jar;%AGENT_LIB%\xercesImpl.jar;%AGENT_LIB%\xalan.jar;%AGENT_LIB%\serializer.jar;%WEBLOGIC_CLASSPATH%;%AGENT_LIB%\NidsCommonAgent.jar;%AGENT_LIB%\NidsWebLogicAgent.jar;%AGENT_LIB%\LogEvent.jar;%AGENT_LIB%\jcc.jar;%AGENT_LIB%\nxpe.jar;%AGENT_LIB%\nxpe-toolkit.jar;%AGENT_LIB%\commons-jxpath-1.2.jar
The WEBLOGIC_CLASSPATH value needs to be added to the file without adding line breaks or spaces.
Save the changes.
Edit the domain environment variable file.
Linux: 1. For the Linux platform, edit the WL_DOMAIN/bin/setDomainEnv.sh file and add the following lines to the end of the script. The JAVA_OPTIONS need to be copied into the file with no line breaks.
# Java Properties for Novell Access Manager JACC Provider
JAVA_OPTIONS="${JAVA_OPTIONS} -Djava.security.manager -Djava.security.policy=${WL_HOME}/server/lib/weblogic.policy -Djavax.security.jacc.policy.provider=com.novell.nids.agent.policy.weblogic.WebLogicPolicy -Djavax.security.jacc.PolicyConfigurationFactory.provider=com.novell.nids.agent.policy.weblogic.WebLogicPolicyConfigurationFactory -Dweblogic.security.jacc.RoleMapperFactory.provider=com.novell.nids.agent.policy.weblogic.WebLogicRoleMapperFactory -Dweblogic.net.http.URLStreamHandlerFactory=com.novell.nids.agent.util.JsseURLStreamHandlerFactory"
export JAVA_OPTIONS
Windows: For the Windows platform, edit WL_DOMAIN\bin\setDomainEnv.cmd and add the following lines to the end of the file. If you installed the Agent into a directory other than C:\Novell, update the Djcc.dir option. The set command needs to be copied into the file with no line breaks.
@REM Java Properties for Novell Access Manager JACC Provider set JAVA_OPTIONS=%JAVA_OPTIONS% -Djava.security.manager -Djava.security.policy=%WL_HOME%\server\lib\weblogic.policy -Djavax.security.jacc.policy.provider=com.novell.nids.agent.policy.weblogic.WebLogicPolicy -Djavax.security.jacc.PolicyConfigurationFactory.provider=com.novell.nids.agent.policy.weblogic.WebLogicPolicyConfigurationFactory -Dweblogic.security.jacc.RoleMapperFactory.provider=com.novell.nids.agent.policy.weblogic.WebLogicRoleMapperFactory -Djcc.dir=C:\Novell\devman\jcc -Dweblogic.net.http.URLStreamHandlerFactory=com.novell.nids.agent.util.JsseURLStreamHandlerFactory
Edit the WL_HOME/server/lib/weblogic.policy file and add the following lines to the end of the script:
grant {
permission java.security.AllPermission;
};
For information on why we grant Java 2 permission to everything, see Understanding the Permission Configuration for JACC.
Continue with Configuring Log In
To configure log in, you can use either the WebLogic Administration Console or a script:
Start WebLogic.
Execute the WebLogic scripting tool. Specify the command appropriate for the platform:
Linux: WL_HOME/common/bin/wlst.sh
Windows: WL_HOME\common\bin\wlst.cmd
To the command, add the appropriate parameters to execute the weblogic_config.jy script. Separate each parameter with a space. Running the script without additional parameters prints the required parameters.
Linux Example: /opt/bea/weblogic92/common/bin/wlst.sh /opt/novell/nids_agents/bin/weblogic_config.jy weblogic password base_domain AdminServer localhost:7001
Windows Example: C:\bea\weblogic92\common\bin\wlst.cmd C:\Novell\bin\weblogic_config.jy weblogic password base_domain AdminServer localhost:7001
Use the WebLogic scripting tool to execute the weblogic_nesp_deploy.jy script. Separate each parameter with a space. Running the script without additional parameters prints the required parameters.
Linux Example: /opt/bea/weblogic92/common/bin/wlst.sh /opt/novell/nids_agents/bin/weblogic_nesp_deploy.jy weblogic password AdminServer localhost:7001 /root/temp/nesp.ear
Windows Example: C:\bea\weblogic92\common\bin\wlst.cmd C:\Novell\bin\weblogic_nesp_deploy.jy weblogic password AdminServer localhost:7001 C:\Novell\nesp.ear
Restart the WebLogic server.
The agent should import into Access Manager Administration Console when the WebLogic server starts. Before restarting the WebLogic server, decide whether you want to deploy the Payroll application to test the agent. See Deploying the Example Payroll Application.
The J2EE Agent must be configured before users can access resources. See Section 2.0, Configuring the Agent for Authentication.
In the WebLogic Administration Console, you need to complete the following tasks:
Start WebLogic.
In a browser, log in to the WebLogic Administration console:
http://<weblogic ip>:7001/console
Replace <weblogic ip> with the IP address or DNS name of your WebLogic Administration Console.
In the list, click .
Click the default realm ().
Click the tab.
In the top right corner, click .
In the list, click .
Specify a name in the field, select for the , then click .
In the list, click and change the from to .
Return to the list.
Change the > to .
Click .
Wait until you have deployed the nesp.ear file before restarting the WebLogic server.
The nesp.ear application is a required component of the J2EE Agent.
In the WebLogic Administration console, click in the list.
Click .
Click .
In the field, click the server.
Browse to the directory containing the nesp.ear application.
Click the radio button next to the application.
Click .
Select , then click .
Accept the default settings, then click .
Click .
Start nesp by selecting the nesp application, clicking and selecting . Click when asked if you want to start the deployment.
Log out and restart the WebLogic server.
The agent should import into Access Manager Administration Console when the WebLogic server starts. Before restarting the WebLogic server, decide whether you want to deploy the Payroll application to test the agent. See Deploying the Example Payroll Application.
The J2EE Agent must be configured before users can access resources. See Section 2.0, Configuring the Agent for Authentication.
Whenever you deploy a new application, you need to restart the WebLogic server. To deploy the payroll application, use the same process that you used for the nesp.ear application. See .
Use the following values:
Location: The PayrollApp.ear application is located in /opt/novell/nids_agents/examples directory on Linux and <Install_Directory>\sampleapp directory on Windows.
Type: When prompted, select .
To start the Payroll application, click .
Restart the WebLogic server.
The J2EE Agent must be configured before users can access resources. See Section 2.0, Configuring the Agent for Authentication.
When you enable JACC, WebLogic requires that you enable Java 2 Security with the -Djava.security.manager option. Java 2 Security uses the weblogic.policy file to determine access to resources. In addition, you should be able to specify permissions inside the weblogic-ejb-jar.xml and weblogic.xml files for deployed applications.
There appears to be a bug in WebLogic 9.2 because even the Administration Console application does not function with the default permissions in the weblogic.policy file. In addition, if you look at the weblogic.xml deployment descriptor for the console application, it has the lines:
grant {
java.security.AllPermission
};
This should configure the console application so that it does not have any issues with Java 2 permissions, but when you enable the security manager, the console does indeed have some problems with permissions.
This bug also prevents some of the permissions for the agent to be explicitly set. The only workaround Novell has found is to grant Java 2 permissions to everything. This should not add any additional security risk than running WebLogic without the security manager enabled, which is the default configuration for WebLogic.